docs: add comprehensive project wiki for v1.0

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

droid-wiki/applications/index.md

@@ -0,0 +1,3 @@
+# Applications
+
+rustunnel ships as a single binary application with five CLI commands. There are no separate services, daemons, or web frontends.

droid-wiki/applications/rustunnel-cli.md

@@ -0,0 +1,57 @@
+# rustunnel CLI
+
+The rustunnel binary exposes five subcommands defined in `src/cli.rs` and dispatched in `src/main.rs`.
+
+## Commands
+
+### `listen`
+
+Start the HTTPS tunnel listener. Binds an HTTPS server that accepts mTLS connections from connectors.
+
+Key arguments:
+- `--listen` — bind address (default `0.0.0.0:4180`)
+- `--advertise` — public address embedded in auto-generated connection keys
+- `--connection-key` — reusable key generated by `keygen` or a previous `listen` run
+- `--socks` — optional server-side SOCKS5 proxy address for connector-side network access
+- `--cert`, `--key`, `--ca-cert` — TLS material paths (required unless using a connection key)
+- `--auth-token`, `--auth-token-file` — application auth token
+- `--insecure-skip-tls-verify` — skip client certificate verification (lab only)
+
+When run without explicit certificate paths and without a connection key, `listen` auto-generates a new connection key and prints it.
+
+### `connect`
+
+Connect to the listener and expose a local SOCKS5 proxy.
+
+Key arguments:
+- `CONNECTION_KEY` — positional connection key (optional)
+- `--target` — listener address (default from connection key)
+- `--connection-key` — connection key via flag or env `RUSTUNNEL_KEY`
+- `--socks` — local SOCKS5 proxy address (default `127.0.0.1:1180`)
+- `--cert`, `--key`, `--ca-cert` — TLS material paths (required unless using a connection key)
+- `--insecure-skip-tls-verify` — skip server certificate verification (lab only)
+
+### `generate`
+
+Generate local certificate and auth material into an output directory.
+
+Creates: `ca.pem`, `ca.key`, `server.crt`, `server.key`, `client.crt`, `client.key`, `token.txt`, `config.json`.
+
+### `keygen`
+
+Generate a single reusable connection key string. This bundles all certificate material, the auth token, and the target address into a base64-encoded JSON blob prefixed with `rtun1.`.
+
+### `version`
+
+Print version, edition, platform, and architecture.
+
+## Entry point
+
+`src/main.rs` installs the ring crypto provider, initializes tracing with an env-filter defaulting to `info`, parses the CLI, and dispatches to the appropriate runner function.
+
+## Key source files
+
+| File | Purpose |
+| ---- | ------- |
+| `src/cli.rs` | clap `Parser` and `Subcommand` definitions |
+| `src/main.rs` | Entry point, command dispatch, host:port parsing helpers |